Granted Patent B2

US 12,574,734 · App. 18/225,022 · Granted Mar 10, 2026

Inventors: Sachin Verma (Danville, CA); Leonid Burakovsky (Pleasanton, CA); Apoorva Jain (San Jose, CA); John Edward McDowall (Redwood City, CA)

Assignee: Palo Alto Networks, Inc.

H04W12/088H04L63/1425H04W12/72

Abstract

Claims (39)

1 . A system, comprising:

a processor configured to:

monitor network traffic in a core mobile network using a security platform executed on a network element in the core mobile network to identify a new session that attached to the core mobile network for mobile network communications, wherein the new session includes a flow;

extract meta information associated with the new session using the security platform executed on the network element in the core mobile network, wherein the meta information includes one or more of the following: subscriber identity information, equipment identity information, location information, access point name (APN), data network name (DNN), user equipment (UE) device information, radio access technology (RAT) information, network slice information;

apply selective intelligent offloading using the security platform if the extracted meta information associated with the new session matches a selective intelligent offload policy, comprising to:

determine whether a first IP address associated with at least one packet in the flow matches a second IP address associated with a selective intelligent enforcement rule in the selective intelligent offload policy; and

in response to a determination that the first IP address matches the second IP address:

set up the new session for the flow; and

send traffic associated with the flow to the security platform to apply security; and

perform traffic inspection by the security platform if the extracted meta information associated with the new session does not match a selective intelligent offload policy; and

a memory coupled to the processor and configured to provide the processor with instructions.

2 . The system recited in claim 1 , wherein the security platform is executed on a host entity in the core mobile network.

3 . The system recited in claim 1 , wherein the security platform is a virtual firewall executed on a host entity in the core mobile network.

4 . The system recited in claim 1 , wherein the offloading of the new session to bypass inspection by the security platform if the extracted meta information associated with the new session matches the selective intelligent offload policy is performed by offloading the new session to a smart network interface card (NIC) of the network element.

5 . The system recited in claim 1 , wherein the offloading of the new session to bypass inspection by the security platform if the extracted meta information associated with the new session matches the selective intelligent offload policy is performed by offloading the new session to a smart network interface card (NIC) of the network element, and wherein the smart NIC includes a data processing unit.

6 . The system recited in claim 1 , wherein the security platform is configured with a plurality of security policies to apply network slice based security, subscriber identity based security, equipment identity based security, access point name (APN) based security, data network name (DNN) based security, location based security, and/or radio access technology (RAT) based security in the core mobile network.

7 . The system recited in claim 1 , wherein the processor is further configured to:

extract the meta information associated with the new session using the security platform executed on the network element in the core mobile network by performing inspection of packet forwarding control protocol (PFCP) messages, application programming interfaces (APIs), and/or syslog messages.

8 . A method, comprising:

monitoring network traffic in a core mobile network using a security platform executed on a network element in the core mobile network to identify a new session that attached to the core mobile network for mobile network communications, wherein the new session includes a flow;

extracting meta information associated with the new session using the security platform executed on the network element in the core mobile network, wherein the meta information includes one or more of the following: subscriber identity information, equipment identity information, location information, access point name (APN), data network name (DNN), user equipment (UE) device information, radio access technology (RAT) information, network slice information;

applying apply selective intelligent offloading using the security platform if the extracted meta information associated with the new session matches a selective intelligent offload policy, comprising:

determining whether a first IP address associated with at least one packet in the flow matches a second IP address associated with a selective intelligent enforcement rule in the selective intelligent offload policy; and

in response to a determination that the first IP address matches the second IP address:

setting up the new session for the flow; and

sending traffic associated with the flow to the security platform to apply security; and

performing traffic inspection by the security platform if the extracted meta information associated with the new session does not match a selective intelligent offload policy.

9 . The method of claim 8 , wherein the security platform is executed on a host entity in the core mobile network.

10 . The method of claim 8 , wherein the security platform is a virtual firewall executed on a host entity in the core mobile network.

11 . The method of claim 8 , wherein the offloading of the new session to bypass inspection by the security platform if the extracted meta information associated with the new session matches the selective intelligent offload policy is performed by offloading the new session to a smart network interface card (NIC) of the network element.

12 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

monitoring network traffic in a core mobile network using a security platform executed on a network element in the core mobile network to identify a new session that attached to the core mobile network for mobile network communications, wherein the new session includes a flow;

extracting meta information associated with the new session using the security platform executed on the network element in the core mobile network, wherein the meta information includes one or more of the following: subscriber identity information, equipment identity information, location information, access point name (APN), data network name (DNN), user equipment (UE) device information, radio access technology (RAT) information, network slice information;

applying apply selective intelligent offloading using the security platform if the extracted meta information associated with the new session matches a selective intelligent offload policy, comprising:

determining whether a first IP address associated with at least one packet in the flow matches a second IP address associated with a selective intelligent enforcement rule in the selective intelligent offload policy; and

in response to a determination that the first IP address matches the second IP address:

setting up the new session for the flow; and

sending traffic associated with the flow to the security platform to apply security; and

performing traffic inspection by the security platform if the extracted meta information associated with the new session does not match a selective intelligent offload policy.

Assignments (1)

Continuity (1)

References Cited (102)