Context-based security over interfaces in NG-RAN environments in mobile networks

1. A system, comprising:

a processor configured to:

monitor network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session;

extract a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform further comprises:

extract User Plane (UP) transport layer information from a HANDOVER REQUEST message exchanged between NG-RAN nodes to set up the GTP-U tunnel session;

inspect XnAP traffic over an Xn-C interface between the NG-RAN nodes in an NG-RAN environment in the mobile network to extract contextual information; and

inspect GTP-U traffic over an Xn-U interface between the NG-RAN nodes for applying layer-7 security on User Plane (UP) traffic; and

enforce a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between the NG-RAN nodes in an NG-RAN environment in the mobile network; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the security platform extracts User Plane (UP) transport layer information extracted from the HANDOVER REQUEST message to set up the GTP-U tunnel session.

3. The system recited in claim 1 , wherein the security platform is configured with a plurality of security policies to apply the context-based security to the network traffic transported between the NG-RAN nodes in the NG-RAN environment in the mobile network.

4. The system recited in claim 1 , wherein the processor is further configured to:

inspect the XnAP traffic over the Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information.

5. The system recited in claim 1 , wherein the processor is further configured to:

inspect the XnAP traffic over the Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information; and

store the contextual information locally in the security platform or in a cloud-based storage.

6. The system recited in claim 1 , wherein the processor is further configured to:

inspect GTP-U traffic over the Xn-U interface between a source NG-RAN node and a target NG-RAN node to apply Layer-7 security on user plane traffic; and

correlate the context information with the user plane traffic to perform context-based security for inter node traffic in the NG-RAN environment.

7. The system recited in claim 1 , wherein the security platform is configured to perform context-based security over the Xn-U interface in the NG-RAN environment.

8. The system recited in claim 1 , wherein the security platform is configured to perform detection and prevention of known and unknown threat identification and prevention over the Xn-U interface in the NG-RAN environment.

9. The system recited in claim 1 , wherein the security platform is configured to perform application identification and control over the Xn-U interface in the NG-RAN environment.

10. The system recited in claim 1 , wherein the security platform is configured to perform URL filtering over the Xn-U interface in the NG-RAN environment.

11. The system recited in claim 1 , wherein the processor is further configured to:

block the new session from accessing a resource based on the security policy.

12. The system recited in claim 1 , wherein the processor is further configured to:

allow the new session to access a resource based on the security policy.

13. A method, comprising:

monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session;

extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform; and platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform further comprises:

extracting User Plane (UP) transport layer information from a HANDOVER REQUEST message exchanged between NG-RAN nodes to set up the GTP-U tunnel session;

inspecting XnAP traffic over an Xn-C interface between the NG-RAN nodes in an NG-RAN environment in the mobile network to extract contextual information; and

inspecting GTP-U traffic over an Xn-U interface between the NG-RAN nodes for applying layer-7 security on User Plane (UP) traffic; and

enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between the NG-RAN nodes in an NG-RAN environment in the mobile network.

14. The method of claim 13 , wherein the security platform extracts User Plane (UP) transport layer information extracted from the HANDOVER REQUEST message to set up the GTP-U tunnel session.

15. The method of claim 13 , wherein the security platform is configured with a plurality of security policies to apply the context-based security to the network traffic transported between the NG-RAN nodes in the NG-RAN environment in the mobile network.

16. The method of claim 13 , further comprising:

inspecting the XnAP traffic over the Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information.

17. The method of claim 13 , further comprising:

inspecting the XnAP traffic over the Xn-C interface between a source NG-RAN node and a target NG-RAN node to extract contextual information; and

storing the contextual information locally in the security platform or in a cloud-based storage.

18. The method of claim 13 , further comprising:

inspecting GTP-U traffic over the Xn-U interface between a source NG-RAN node and a target NG-RAN node to apply Layer-7 security on user plane traffic; and

correlating the context information with the user plane traffic to perform context-based security for inter node traffic in the NG-RAN environment.

19. The method of claim 13 , further comprising:

performing context-based security over the Xn-U interface in the NG-RAN environment.

20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

monitoring network traffic on a mobile network at a security platform to identify a GTP-U tunnel session setup message associated with a new session;

extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform, wherein extracting a plurality of parameters from the GTP-U tunnel session setup message and from XnAP traffic to extract contextual information at the security platform further comprises:

extracting User Plane (UP) transport layer information from a HANDOVER REQUEST message exchanged between NG-RAN nodes to set up the GTP-U tunnel session;

inspecting XnAP traffic over an Xn-C interface between the NG-RAN nodes in an NG-RAN environment in the mobile network to extract contextual information; and

inspecting GTP-U traffic over an Xn-U interface between the NG-RAN nodes for applying layer-7 security on User Plane (UP) traffic; and

enforcing a security policy at the security platform on the new session based on one or more of the plurality of parameters to apply context-based security to the network traffic transported between the NG-RAN nodes in an NG-RAN environment in the mobile network.