Customer-specified granular security rules for radio-based applications implemented using cloud resources
A set of security rules for user plane traffic of a subset of user equipment (UE) devices of a radio-based application is received via programmatic interfaces at a service of a cloud provider network. A packet comprising user data associated with a UE device of the subset is received at a network function implementation server of the service. An action indicated in a security rule is implemented with respect to the packet at the server.
1 . A system, comprising:
one or more processors and corresponding memory to implement a control plane server of a radio-based application management service of a cloud computing environment; and
one or more processors and corresponding memory to implement a network function implementation server of the radio-based application management service;
wherein the one or more processors and corresponding memory of the control plane server is configured to:
receive, via a programmatic interface from a client of the radio-based application management service, a set of firewall rules to be enforced, by the network function implementation server, on user plane traffic of a subset of user equipment (UE) devices of a plurality of UE devices of a radio-based application, wherein the set of firewall rules comprises a particular firewall rule prohibiting transmission of a given packet to a UE device; and
cause a representation of a particular firewall rule of the set of firewall rules to be propagated to the network function implementation server; and
wherein the one or more processors and corresponding memory of the network function implementation server is configured to:
in response to (a) receiving a first packet of the radio-based application, comprising user data directed to a first UE device of the subset and (b) determining that the particular firewall rule does not prohibit transmission of the first packet to the first UE device, execute a particular network function of a core network layer of the radio-based application with respect to the first packet, and cause the first packet to be transmitted to the first UE device; and
in response to (a) receiving a second packet of the radio-based application, comprising user data directed to a second UE device and (b) determining that the particular firewall rule prohibits transmission of the second packet to the second UE device, drop the second packet without executing the particular network function with respect to the second packet.
2 . The system as recited in claim 1 , wherein the control plane server is further configured to:
obtain, from the client, a text string which is to be utilized as a tag for the subset of UE devices, wherein the set of firewall rules specify the text string to indicate applicability of the set of firewall rules to the subset of UE devices.
3 . The system as recited in claim 1 , wherein the control plane server is further configured to:
obtain, from the client, an indication that the subset of UE devices to which the set of firewall rules applies is to be identified based at least in part on one or more of: (a) Internet Protocol (IP) addresses of individual ones of the UE devices or (b) hardware device identifiers of individual ones of the UE devices.
4 . The system as recited in claim 1 , wherein the control plane server is further configured to:
obtain, from the client, an indication that the subset of UE devices to which the set of firewall rules applies is to be identified based at least in part on physical location of individual ones of the UE devices.
5 . The system as recited in claim 1 , wherein the network function implementation server is located at an edge premise of the cloud computing environment, and wherein the control plane server is located at a regional data center of the cloud computing environment.
6 . A computer-implemented method, comprising:
obtaining, via one or more programmatic interfaces at a radio-based application management service of a cloud provider network, a set of security rules to be enforced on user plane traffic of a subset of user equipment (UE) devices of a plurality of UE devices of a radio-based application, wherein one or more of the set of security rules indicate one or more actions to be taken with respect to one or more packets of the user plane traffic;
receiving a packet of the radio-based application, comprising user data associated with a UE device of the subset, at a network function implementation server of the radio-based application management service, wherein the network function implementation server is configured to execute one or more network functions of the radio-based application with respect to packets of the radio-based application; and
in accordance with a particular security rule, of the set of security rules obtained via the one or more programmatic interfaces at the radio-based application management service, indicating an action of the one or more actions to be taken with respect to one or more packets of the user plane traffic,
causing, by the network function implementation server, the action to be implemented with respect to the packet, without executing the one or more network functions with respect to the packet.
7 . The computer-implemented method as recited in claim 6 , wherein the action indicated in the particular security rule comprises one or more of: (a) dropping the packet, (b) analyzing contents of the packet or (c) generating a notification.
8 . The computer-implemented method as recited in claim 6 , wherein one or more network functions include one or more of: (a) a core network function or (b) a network function of a centralized unit (CU) of a radio access network (RAN) node.
9 . The computer-implemented method as recited in claim 6 , further comprising:
obtaining, via the one or more programmatic interfaces at the radio-based application management service, a text string which is to be utilized as a tag for the subset of UE devices, wherein the set of security rules specify the text string to indicate applicability of the set of security rules to the subset of UE devices.
10 . The computer-implemented method as recited in claim 6 , wherein to indicate applicability of the set of security rules to the subset of UE devices, the set of security rules specify one or more of: (a) Internet Protocol (IP) addresses of at least some UE devices of the subset or (b) hardware device identifiers of at least some UE devices of the subset.
11 . The computer-implemented method as recited in claim 6 , wherein to indicate applicability of the set of security rules to the subset of UE devices, the set of security rules indicate a physical or geographical location of the subset of UE devices, without specifying respective identifiers of individual ones of the UE devices of the subset.
12 . The computer-implemented method as recited in claim 6 , wherein the set of security rules specify a network port to be used to determine whether the particular security rule applies to a particular packet.
13 . The computer-implemented method as recited in claim 6 , wherein the set of security rules specify a network protocol to be used to determine whether the particular security rule applies to a particular packet.
14 . The computer-implemented method as recited in claim 6 , wherein the network function implementation server is located at an edge premise of the cloud computing environment.
15 . The computer-implemented method as recited in claim 6 , further comprising:
in response to obtaining the set of security rules,
generating one or more PFCP (packet forwarding control protocol) messages indicating the particular security rule; and
propagating the one or more PFCP messages to the network function implementation server.
16 . A non-transitory computer-accessible storage medium storing program instructions that when executed on a processor:
obtain, via one or more programmatic interfaces at a radio-based application management service of a cloud provider network, a set of security rules to be enforced on user plane traffic of a subset of user equipment (UE) devices of a plurality of UE devices of a radio-based application, wherein one or more of the set of security rules indicate one or more actions to be taken with respect to one or more packets of the user plane traffic;
receive a packet of the radio-based application, comprising user data associated with a UE device of the subset, at a network function implementation server of the radio-based application management service, wherein the network function implementation server is configured to execute one or more network functions of the radio-based application with respect to packets of the radio-based application; and
in accordance with a particular security rule, of the set of security rules obtained via the one or more programmatic interfaces at the radio-based application management service, indicating an action of the one or more actions to be taken with respect to one or more packets of the user plane traffic, cause, by the network function implementation server, the action to be implemented with respect to the packet.
17 . The non-transitory computer-accessible storage medium as recited in claim 16 , wherein the action indicated in the particular security rule comprises one or more of: (a) dropping the packet, (b) analyzing contents of the packet or (c) generating a notification.
18 . The non-transitory computer-accessible storage medium as recited in claim 16 , wherein the network function implementation server is configured to execute one or more network functions of the radio-based application including one or more of: (a) a core network function or (b) a network function of a centralized unit (CU) of a radio access network (RAN) node.
19 . The non-transitory computer-accessible storage medium as recited in claim 16 , wherein the UE device comprises one of: (a) a phone, (b) a robot, (c) a sensor device, (d) an Internet-of-Things (IoT) device, (e) a portable computer system, (f) an augmented reality/virtual reality (AR/VR) device or (g) a voice-activated personal assistant device.
20 . The non-transitory computer-accessible storage medium as recited in claim 16 , wherein the UE device comprises an access point configured to (a) distribute packets, received via one or more network function implementation servers of the radio-based application, among a plurality of other devices of a particular customer network and (b) transmit packets, originating at the plurality of other devices, to one or more destinations outside the particular customer network via the one or more network function implementation servers.