Quarantined communications processing at a network edge
Embodiments disclosed herein provide systems and methods for quarantining communications at a network edge by routing traffic through a specialized network edge system. In a particular embodiment a method provides, identifying criteria indicating whether certain network traffic should be handled by the specialized network edge system. The method further provides receiving first information about first network traffic received at a first network edge system for a communication network. In response to determining, based on the first information, that the first network traffic satisfies the criteria, the method provides routing the first network traffic through the specialized network edge system.
1. A method of routing network traffic through a specialized network edge system for a communication network, the method comprising:
in an edge system controller within the communication network:
identifying criteria indicating whether certain network traffic should be handled by the specialized network edge system;
receiving, from a first network edge system for the communication network, first information about first network traffic entering the communication network through the first network edge system from outside the communication network; and
in response to determining, based on the first information, that the first network traffic satisfies the criteria, routing the first network traffic through the specialized network edge system.
2. The method of claim 1 , further comprising:
receiving second information about second network traffic received at a second network edge system for the communication network; and
in response to determining, based on the second information, that the second network traffic satisfies the criteria, routing the second network traffic through the specialized network edge system.
3. The method of claim 2 , wherein the first and second network edge systems comprise two of a plurality of network edge systems from which information about network traffic is received.
4. The method of claim 1 , wherein the criteria define network traffic characteristics indicative of malicious network traffic.
5. The method of claim 1 , wherein the specialized network edge system is configured to perform at least one processing function on the first network traffic that the first network edge system does not perform.
6. The method of claim 1 , wherein receiving the first information comprises receiving the first information in an edge system controller from the first network edge system via a real-time application programming interface (API) of the edge system controller.
7. The method of claim 1 , wherein the specialized network edge system comprises a virtualized computing element.
8. The method of claim 7 , further comprising:
instantiating the specialized network edge system in a quarantined software defined network.
9. The method of claim 1 , wherein the first network edge system and the specialized network edge system each comprise a session border controller (SBC) for the communication network.
10. The method of claim 1 , wherein the first network traffic comprises session initiation protocol (SIP) traffic directed to a destination system within the communication network.
11. A system for routing network traffic through a specialized network edge system for a communication network, the system comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
identify criteria indicating whether certain network traffic should be handled by the specialized network edge system;
receiving, from a first network edge system for the communication network, first information about first network traffic entering the communication network through the first network edge system from outside the communication network; and
in response to determining, based on the first information, that the first network traffic satisfies the criteria, route the first network traffic through the specialized network edge system.
12. The system of claim 11 , wherein the program instructions further direct the processing system to:
receive second information about second network traffic received at a second network edge system for the communication network; and
in response to determining, based on the second information, that the second network traffic satisfies the criteria, route the second network traffic through the specialized network edge system.
13. The system of claim 12 , wherein the first and second network edge systems comprise two of a plurality of network edge systems from which information about network traffic is received.
14. The system of claim 11 , wherein the criteria define network traffic characteristics indicative of malicious network traffic.
15. The system of claim 11 , wherein the specialized network edge system is configured to perform at least one processing function on the first network traffic that the first network edge system does not perform.
16. The system of claim 11 , wherein the system implements an edge system controller and wherein to receive the first information the program instructions direct the processing system to at least receive the first information from the first network edge system via a real-time application programming interface (API) of the edge system controller.
17. The system of claim 11 , wherein the specialized network edge system comprises a virtualized computing element.
18. The system of claim 17 , wherein the program instructions further direct the processing system to:
instantiate the specialized network edge system in a quarantined software defined network.
19. The system of claim 11 , wherein the first network edge system and the specialized network edge system each comprise a session border controller (SBC) for the communication network.
20. The system of claim 11 , wherein the first network traffic comprises session initiation protocol (SIP) traffic directed to a destination system within the communication network.