Granted Patent B1

US 12,245,036 · App. 18/769,302 · Granted Mar 4, 2025

Inventors: Kallol Banerjee (San Jose, CA); Jonathan Bosanac (Ennis, MT); Milind Gunjan (Olathe, KS)

Assignee: Netskope, Inc.

H04W12/088H04W8/20H04W12/72

Abstract

Claims (75)

1. A clientless security system for securing a plurality of cellular devices across a cellular network in a cloud-based environment, the clientless security system comprises:

a tenant of a plurality of tenants using a plurality of cellular networks, the tenant includes the plurality of cellular devices;

a plurality of tunnels between a cellular device of the plurality of cellular devices and the cellular network, the plurality of tunnels is operable to:

transmit traffic from the cellular device of the plurality of cellular devices at the cellular network; and

identify traffic associated with a plurality of network identifiers;

a traffic steering module to route traffic towards a gateway of a plurality of gateways in the cloud-based environment, wherein the traffic steering module is operable to:

provision a Subscriber Identity Module (SIM) with the plurality of network identifiers;

configure the SIM with a custom network identifier;

create a device-to-IP mapping;

distribute the device-to-IP mapping to the plurality of gateways in real-time; and

route traffic to the gateway of the plurality of gateways using the custom network identifier;

the plurality of gateways to apply a plurality of policies based on a device profile in the cloud-based environment, wherein the plurality of gateways is operable to:

receive traffic from the traffic steering module at the cellular network;

perform a reverse lookup for the cellular device of the plurality of cellular devices using a source IP address;

determine a device identity corresponding to traffic from the cellular device of the plurality of cellular devices;

apply the plurality of policies based on the device profile; and

forward traffic to a destination in the cloud-based environment; and

an alert generator to notify the tenant for a remediation in case of detection of violation of a policy of the plurality of policies.

2. The clientless security system of claim 1 , wherein the plurality of cellular devices authenticates with the cellular network using a network identifier in the SIM and are in active state with IPv4/IPv6 addresses.

3. The clientless security system of claim 1 , wherein the custom network identifier is used for traffic segregation in the cellular network and the custom network identifier is an APN for a 4G network and a DNN for a 5G network.

4. The clientless security system of claim 1 , wherein the device-to-IP mapping is created using a universal unique mobile subscriber identity (UUMSI) identifier as a primary key.

5. The clientless security system of claim 1 , wherein traffic at the cellular network, on a web and on a firewall side, is analyzed by a server name identification (SNI) based URL filtering method that provides security to the plurality of cellular devices.

6. The clientless security system of claim 1 , wherein the device profile is created by analyzing the plurality of policies, traffic patterns, and device types associated with the plurality of tenants.

7. The clientless security system of claim 1 , wherein the remediation in case of detection of violation of the policy of the plurality of policies includes:

blocking a corresponding traffic;

quarantining the cellular device of the plurality of cellular devices; and

allowing limited connectivity to the cellular device of the plurality of cellular devices.

8. A clientless security method for securing a plurality of cellular devices across a cellular network in a cloud-based environment, the clientless security method comprising:

transmitting traffic from a cellular device of the plurality of cellular devices at the cellular network;

identifying traffic associated with a plurality of network identifiers;

routing traffic towards a gateway of a plurality of gateways in the cloud-based environment using a traffic steering module, wherein the traffic steering module is operable to:

provisioning a Subscriber Identity Module (SIM) with the plurality of network identifiers;

configuring the SIM with a custom network identifier;

creating a device-to-IP mapping;

distributing the device-to-IP mapping to the plurality of gateways in real-time; and

routing traffic to the gateway of the plurality of gateways using the custom network identifier;

applying a plurality of policies based on a device profile in the cloud-based environment using the plurality of gateways, wherein the plurality of gateways is operable to:

receiving traffic from the traffic steering module at the cellular network;

performing a reverse lookup for the cellular device of the plurality of cellular devices using a source IP address;

determining a device identity corresponding to traffic from the cellular device of the plurality of cellular devices;

applying the plurality of policies based on the device profile; and

forwarding traffic to a destination in the cloud-based environment; and

notifying a tenant for a remediation in case of detection of violation of a policy of the plurality of policies.

9. The clientless security method of claim 8 , wherein the plurality of cellular devices authenticates with the cellular network using a network identifier in the SIM and are in active state with IPv4/IPv6 addresses.

10. The clientless security method of claim 8 , wherein the custom network identifier is used for traffic segregation in the cellular network and the custom network identifier is an APN for a 4G network and a DNN for a 5G network.

11. The clientless security method of claim 8 , wherein the device-to-IP mapping is created using a universal unique mobile subscriber identity (UUMSI) identifier as a primary key.

12. The clientless security method of claim 8 , wherein traffic at the cellular network, on a web and on a firewall side, is analyzed by a server name identification (SNI) based URL filtering method that provides security to the plurality of cellular devices.

13. The clientless security method of claim 8 , wherein the device profile is created by analyzing the plurality of policies, traffic patterns, and device types associated with a plurality of tenants.

14. The clientless security method of claim 8 , wherein the remediation in case of detection of violation of the policy of the plurality of policies further comprises:

blocking a corresponding traffic;

quarantining the cellular device of the plurality of cellular devices; and

allowing limited connectivity to the cellular device of the plurality of cellular devices.

15. A non-transitory computer-readable media having computer-executable instructions embodied thereon that, when executed by one or more processors, facilitate a clientless security method for securing a plurality of cellular devices across a cellular network in a cloud-based environment, the clientless security method comprising:

transmitting traffic from a cellular device of the plurality of cellular devices at the cellular network;

identifying traffic associated with a plurality of network identifiers;

routing traffic towards a gateway of a plurality of gateways in the cloud-based environment using a traffic steering module, wherein the traffic steering module is operable to:

provisioning a Subscriber Identity Module (SIM) with the plurality of network identifiers;

configuring the SIM with a custom network identifier;

creating a device-to-IP mapping;

distributing the device-to-IP mapping to the plurality of gateways in real-time; and

routing traffic to the gateway of the plurality of gateways using the custom network identifier;

applying a plurality of policies based on a device profile in the cloud-based environment using the plurality of gateways, wherein the plurality of gateways is operable to:

receiving traffic from the traffic steering module at the cellular network;

performing a reverse lookup for the cellular device of the plurality of cellular devices using a source IP address;

determining a device identity corresponding to traffic from the cellular device of the plurality of cellular devices;

applying the plurality of policies based on the device profile; and

forwarding traffic to a destination in the cloud-based environment; and

notifying a tenant for a remediation in case of detection of violation of a policy of the plurality of policies.

16. The non-transitory computer-readable media of claim 15 , wherein the plurality of cellular devices authenticates with the cellular network using a network identifier in a SIM and are in active state with IPv4/IPv6 addresses.

17. The non-transitory computer-readable media of claim 15 , wherein the custom network identifier is used for traffic segregation in the cellular network and the custom network identifier is an APN for a 4G network and a DNN for a 5G network.

18. The non-transitory computer-readable media of claim 15 , wherein the device-to-IP mapping is created using a universal unique mobile subscriber identity (UUMSI) identifier as a primary key.

19. The non-transitory computer-readable media of claim 15 , wherein the device profile is created by analyzing the plurality of policies, traffic patterns, and device types associated with a plurality of tenants.

20. The non-transitory computer-readable media of claim 15 , wherein the remediation in case of detection of violation of the policy of the plurality of policies further comprises:

blocking a corresponding traffic; quarantining the cellular device of the plurality of cellular devices; and

allowing limited connectivity to the cellular device of the plurality of cellular devices.

Assignments (1)

References Cited (139)

Cited By (3)

US 12,552,406 US 12,615,257 US 12,634,261